AtlSecCon 2022

JWTs are an important part of how modern APIs are used, they assert your identify to the application. You will see them in SOAP, REST, and GraphQL. Many decisions about authorization and access are based on the claims contained within the JWT. If there are vulnerabilities within the framework used to create them, or in implementation decisions, the impact can be high. In this talk , I will discuss how JWTs are generated and used. Security issues can include information disclosure, authentication bypass, authorization control bypass, password cracking, JWT reuse, algorithms such as None, and algorithm exchange. I will demonstrate the None algorithm attack, cracking the secret key used to sign the JWT, and algorithm exchange.